authenticate to user api route, /logout to destroy the session
better flow